| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20260211075547.138904-1-dqfext@gmail.com>
Date: Wed, 11 Feb 2026 15:55:46 +0800
From: Qingfang Deng <dqfext@...il.com>
To: linux-ppp@...r.kernel.org,
rp-pppoe@...ts.skoll.ca,
Michal Ostrowski <mostrows@...thlink.net>,
Andrew Lunn <andrew+netdev@...n.ch>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
James Chapman <jchapman@...alix.com>,
Simon Horman <horms@...nel.org>,
netdev@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: Michal Ostrowski <mostrows@...il.com>,
Dianne Skoll <dianne@...ll.ca>,
Paul Mackerras <paulus@...abs.org>,
Jaco Kroon <jaco@....co.za>,
James Carlson <carlsonj@...kingcode.com>,
Arnd Bergmann <arnd@...db.de>,
Guillaume Nault <gnault@...hat.com>
Subject: [PATCH RFC net-next] pppoe: remove unused kernel-mode relay support
The kernel-mode PPPoE relay feature and its two associated ioctls
(PPPOEIOCSFWD and PPPOEIOCDFWD) are not used by any existing userspace
PPPoE implementations. The standard userspace package, rp-pppoe [1],
handles relaying entirely in userspace.
This legacy code has remained in the driver since its introduction in
kernel 2.3.99-pre7 for over two decades, but serves no practical
purpose.
Remove the unused relay code.
[1] https://dianne.skoll.ca/projects/rp-pppoe/
Signed-off-by: Qingfang Deng <dqfext@...il.com>
---
drivers/net/ppp/pppoe.c | 82 -----------------------------------
drivers/net/ppp/pppox.c | 13 ------
drivers/net/ppp/pptp.c | 3 --
include/linux/if_pppox.h | 7 ---
include/uapi/linux/if_pppox.h | 10 -----
net/l2tp/l2tp_ppp.c | 3 --
6 files changed, 118 deletions(-)
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 4275b393a454..a126f804e4dd 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -237,25 +237,6 @@ static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
return po;
}
-static inline struct pppox_sock *__get_item_by_addr(struct net *net,
- struct sockaddr_pppox *sp)
-{
- struct net_device *dev;
- struct pppoe_net *pn;
- struct pppox_sock *pppox_sock = NULL;
-
- int ifindex;
-
- dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
- if (dev) {
- ifindex = dev->ifindex;
- pn = pppoe_pernet(net);
- pppox_sock = __get_item(pn, sp->sa_addr.pppoe.sid,
- sp->sa_addr.pppoe.remote, ifindex);
- }
- return pppox_sock;
-}
-
static inline void delete_item(struct pppoe_net *pn, __be16 sid,
char *addr, int ifindex)
{
@@ -369,7 +350,6 @@ static struct notifier_block pppoe_notifier = {
static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
{
struct pppox_sock *po = pppox_sk(sk);
- struct pppox_sock *relay_po;
/* Backlog receive. Semantics of backlog rcv preclude any code from
* executing in lock_sock()/release_sock() bounds; meaning sk->sk_state
@@ -378,17 +358,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
if (sk->sk_state & PPPOX_BOUND) {
ppp_input(&po->chan, skb);
- } else if (sk->sk_state & PPPOX_RELAY) {
- relay_po = __get_item_by_addr(sock_net(sk),
- &po->pppoe_relay);
- if (relay_po == NULL)
- goto abort_kfree;
-
- if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
- goto abort_kfree;
-
- if (!__pppoe_xmit(sk_pppox(relay_po), skb))
- goto abort_kfree;
} else {
if (sock_queue_rcv_skb(sk, skb))
goto abort_kfree;
@@ -656,7 +625,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr_unsized *uservaddr
po->pppoe_ifindex = 0;
memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
- memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
memset(&po->chan, 0, sizeof(po->chan));
po->next = NULL;
po->num = 0;
@@ -783,53 +751,6 @@ static int pppoe_ioctl(struct socket *sock, unsigned int cmd,
err = 0;
break;
- case PPPOEIOCSFWD:
- {
- struct pppox_sock *relay_po;
-
- err = -EBUSY;
- if (sk->sk_state & (PPPOX_BOUND | PPPOX_DEAD))
- break;
-
- err = -ENOTCONN;
- if (!(sk->sk_state & PPPOX_CONNECTED))
- break;
-
- /* PPPoE address from the user specifies an outbound
- PPPoE address which frames are forwarded to */
- err = -EFAULT;
- if (copy_from_user(&po->pppoe_relay,
- (void __user *)arg,
- sizeof(struct sockaddr_pppox)))
- break;
-
- err = -EINVAL;
- if (po->pppoe_relay.sa_family != AF_PPPOX ||
- po->pppoe_relay.sa_protocol != PX_PROTO_OE)
- break;
-
- /* Check that the socket referenced by the address
- actually exists. */
- rcu_read_lock();
- relay_po = __get_item_by_addr(sock_net(sk), &po->pppoe_relay);
- rcu_read_unlock();
- if (!relay_po)
- break;
-
- sk->sk_state |= PPPOX_RELAY;
- err = 0;
- break;
- }
-
- case PPPOEIOCDFWD:
- err = -EALREADY;
- if (!(sk->sk_state & PPPOX_RELAY))
- break;
-
- sk->sk_state &= ~PPPOX_RELAY;
- err = 0;
- break;
-
default:
err = -ENOTTY;
}
@@ -1136,9 +1057,6 @@ static const struct proto_ops pppoe_ops = {
.recvmsg = pppoe_recvmsg,
.mmap = sock_no_mmap,
.ioctl = pppox_ioctl,
-#ifdef CONFIG_COMPAT
- .compat_ioctl = pppox_compat_ioctl,
-#endif
};
static const struct pppox_proto pppoe_proto = {
diff --git a/drivers/net/ppp/pppox.c b/drivers/net/ppp/pppox.c
index 08364f10a43f..5ef422a43d70 100644
--- a/drivers/net/ppp/pppox.c
+++ b/drivers/net/ppp/pppox.c
@@ -17,7 +17,6 @@
#include <linux/string.h>
#include <linux/module.h>
#include <linux/kernel.h>
-#include <linux/compat.h>
#include <linux/errno.h>
#include <linux/netdevice.h>
#include <linux/net.h>
@@ -99,18 +98,6 @@ int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
EXPORT_SYMBOL(pppox_ioctl);
-#ifdef CONFIG_COMPAT
-int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
-{
- if (cmd == PPPOEIOCSFWD32)
- cmd = PPPOEIOCSFWD;
-
- return pppox_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
-}
-
-EXPORT_SYMBOL(pppox_compat_ioctl);
-#endif
-
static int pppox_create(struct net *net, struct socket *sock, int protocol,
int kern)
{
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index b18acd810561..8838ed93eb70 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -634,9 +634,6 @@ static const struct proto_ops pptp_ops = {
.recvmsg = sock_no_recvmsg,
.mmap = sock_no_mmap,
.ioctl = pppox_ioctl,
-#ifdef CONFIG_COMPAT
- .compat_ioctl = pppox_compat_ioctl,
-#endif
};
static const struct pppox_proto pppox_pptp_proto = {
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index db45d6f1c4f4..a015afa672b7 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -25,8 +25,6 @@ struct pppoe_opt {
struct net_device *dev; /* device associated with socket*/
int ifindex; /* ifindex of device associated with socket */
struct pppoe_addr pa; /* what this socket is bound to*/
- struct sockaddr_pppox relay; /* what socket data will be
- relayed to (PPPoE relaying) */
struct work_struct padt_work;/* Work item for handling PADT */
};
@@ -53,7 +51,6 @@ struct pppox_sock {
#define pppoe_dev proto.pppoe.dev
#define pppoe_ifindex proto.pppoe.ifindex
#define pppoe_pa proto.pppoe.pa
-#define pppoe_relay proto.pppoe.relay
static inline struct pppox_sock *pppox_sk(struct sock *sk)
{
@@ -78,16 +75,12 @@ extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
extern void unregister_pppox_proto(int proto_num);
extern void pppox_unbind_sock(struct sock *sk);/* delete ppp-channel binding */
extern int pppox_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
-extern int pppox_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
-
-#define PPPOEIOCSFWD32 _IOW(0xB1 ,0, compat_size_t)
/* PPPoX socket states */
enum {
PPPOX_NONE = 0, /* initial state */
PPPOX_CONNECTED = 1, /* connection established ==TCP_ESTABLISHED */
PPPOX_BOUND = 2, /* bound to ppp device */
- PPPOX_RELAY = 4, /* forwarding is enabled */
PPPOX_DEAD = 16 /* dead, useless, please clean me up!*/
};
diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
index 9abd80dcc46f..8fdf0a681a4e 100644
--- a/include/uapi/linux/if_pppox.h
+++ b/include/uapi/linux/if_pppox.h
@@ -103,16 +103,6 @@ struct sockaddr_pppol2tpv3in6 {
struct pppol2tpv3in6_addr pppol2tp;
} __packed;
-/*********************************************************************
- *
- * ioctl interface for defining forwarding of connections
- *
- ********************************************************************/
-
-#define PPPOEIOCSFWD _IOW(0xB1 ,0, size_t)
-#define PPPOEIOCDFWD _IO(0xB1 ,1)
-/*#define PPPOEIOCGFWD _IOWR(0xB1,2, size_t)*/
-
/* Codes to identify message types */
#define PADI_CODE 0x09
#define PADO_CODE 0x07
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ae4543d5597b..77aa9f5f866d 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1644,9 +1644,6 @@ static const struct proto_ops pppol2tp_ops = {
.recvmsg = pppol2tp_recvmsg,
.mmap = sock_no_mmap,
.ioctl = pppox_ioctl,
-#ifdef CONFIG_COMPAT
- .compat_ioctl = pppox_compat_ioctl,
-#endif
};
static const struct pppox_proto pppol2tp_proto = {
--
2.43.0
Powered by blists - more mailing lists